• Have you considered simply enforcing password policy?